View | Details | Raw Unified | Return to bug 22990
Collapse All | Expand All

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt (+4 lines)
Lines 215-220 Link Here
215
                <h1>Transfer ownership of public list [% shelf.shelfname | html %]</h1>
215
                <h1>Transfer ownership of public list [% shelf.shelfname | html %]</h1>
216
216
217
                <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="transferform" method="post">
217
                <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="transferform" method="post">
218
                    [% INCLUDE 'csrf-token.inc' %]
218
                    <fieldset>
219
                    <fieldset>
219
                        <input type="hidden" name="op" value="transfer" />
220
                        <input type="hidden" name="op" value="transfer" />
220
                        <input type="hidden" name="public" value="1" />
221
                        <input type="hidden" name="public" value="1" />
Lines 247-252 Link Here
247
                [% IF itemsloop %]
248
                [% IF itemsloop %]
248
                    <div class="pages">[% pagination_bar | $raw %]</div>
249
                    <div class="pages">[% pagination_bar | $raw %]</div>
249
                    <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="listform" method="post">
250
                    <form action="/cgi-bin/koha/virtualshelves/shelves.pl" id="listform" method="post">
251
                        [% INCLUDE 'csrf-token.inc' %]
250
                        <input type="hidden" name="op" value="remove_biblios" />
252
                        <input type="hidden" name="op" value="remove_biblios" />
251
                        <input type="hidden" name="referer" value="view" />
253
                        <input type="hidden" name="referer" value="view" />
252
                        <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" />
254
                        <input type="hidden" name="shelfnumber" value="[% shelf.shelfnumber | html %]" />
Lines 395-400 Link Here
395
            [% IF op == 'add_form' OR op == 'edit_form' %]
397
            [% IF op == 'add_form' OR op == 'edit_form' %]
396
398
397
                <form method="post" action="/cgi-bin/koha/virtualshelves/shelves.pl" class="validated">
399
                <form method="post" action="/cgi-bin/koha/virtualshelves/shelves.pl" class="validated">
400
                    [% INCLUDE 'csrf-token.inc' %]
398
                    <fieldset class="rows">
401
                    <fieldset class="rows">
399
                        [% IF op == 'add_form' %]
402
                        [% IF op == 'add_form' %]
400
                            <legend><h1>Create a new list</h1></legend>
403
                            <legend><h1>Create a new list</h1></legend>
Lines 554-559 Link Here
554
    <div class="modal" id="addToList" tabindex="-1" role="dialog" aria-labelledby="addToListLabel">
557
    <div class="modal" id="addToList" tabindex="-1" role="dialog" aria-labelledby="addToListLabel">
555
        <div class="modal-dialog" role="document">
558
        <div class="modal-dialog" role="document">
556
            <form action="/cgi-bin/koha/virtualshelves/shelves.pl" method="post">
559
            <form action="/cgi-bin/koha/virtualshelves/shelves.pl" method="post">
560
                [% INCLUDE 'csrf-token.inc' %]
557
                <div class="modal-content">
561
                <div class="modal-content">
558
                    <div class="modal-header">
562
                    <div class="modal-header">
559
                        <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
563
                        <button type="button" class="closebtn" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/tables/shelves_results.tt (+2 lines)
Lines 39-44 Link Here
39
    [%~ public      = public | html ~%]
39
    [%~ public      = public | html ~%]
40
    [%~ IF can_manage_shelf ~%]
40
    [%~ IF can_manage_shelf ~%]
41
        [%~ action_block =                '<form action="shelves.pl" method="get">' ~%]
41
        [%~ action_block =                '<form action="shelves.pl" method="get">' ~%]
42
        [%~ action_block = action_block _ '[% INCLUDE 'csrf-token.inc' %]' ~%]
42
        [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber  _ '" />' ~%]
43
        [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber  _ '" />' ~%]
43
        [%~ action_block = action_block _ '<input type="hidden" name="op" value="edit_form" />' ~%]
44
        [%~ action_block = action_block _ '<input type="hidden" name="op" value="edit_form" />' ~%]
44
        [%~ action_block = action_block _ '<input type="hidden" name="public" value="' _ public _ '" />' ~%]
45
        [%~ action_block = action_block _ '<input type="hidden" name="public" value="' _ public _ '" />' ~%]
Lines 48-53 Link Here
48
    [%~ END ~%]
49
    [%~ END ~%]
49
    [%~ IF can_delete_shelf ~%]
50
    [%~ IF can_delete_shelf ~%]
50
        [%~ action_block = action_block _ ' <form action="shelves.pl" method="post">' ~%]
51
        [%~ action_block = action_block _ ' <form action="shelves.pl" method="post">' ~%]
52
        [%~ action_block = action_block _ '[% INCLUDE 'csrf-token.inc' %]' ~%]
51
        [%~ action_block = action_block _ '<input type="hidden" name="shelves" value="1" />' ~%]
53
        [%~ action_block = action_block _ '<input type="hidden" name="shelves" value="1" />' ~%]
52
        [%~ action_block = action_block _ '<input type="hidden" name="op" value="delete" />' ~%]
54
        [%~ action_block = action_block _ '<input type="hidden" name="op" value="delete" />' ~%]
53
        [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber  _ '" />' ~%]
55
        [%~ action_block = action_block _ '<input type="hidden" name="shelfnumber" value="' _ shelfnumber  _ '" />' ~%]
(-)a/virtualshelves/shelves.pl (-2 / +7 lines)
Lines 29-35 use C4::Koha qw( Link Here
29
    GetNormalizedUPC
29
    GetNormalizedUPC
30
);
30
);
31
use C4::Members;
31
use C4::Members;
32
use C4::Output qw( pagination_bar output_html_with_http_headers );
32
use C4::Output qw( pagination_bar output_html_with_http_headers output_and_exit_if_error );
33
use C4::XSLT qw( XSLTParse4Display );
33
use C4::XSLT qw( XSLTParse4Display );
34
34
35
use Koha::Biblios;
35
use Koha::Biblios;
Lines 63-68 if ( $op eq 'add_form' ) { Link Here
63
    # Only pass default
63
    # Only pass default
64
    $shelf = { allow_change_from_owner => 1 };
64
    $shelf = { allow_change_from_owner => 1 };
65
} elsif ( $op eq 'edit_form' ) {
65
} elsif ( $op eq 'edit_form' ) {
66
    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
66
    $shelfnumber = $query->param('shelfnumber');
67
    $shelfnumber = $query->param('shelfnumber');
67
    $shelf       = Koha::Virtualshelves->find($shelfnumber);
68
    $shelf       = Koha::Virtualshelves->find($shelfnumber);
68
69
Lines 78-83 if ( $op eq 'add_form' ) { Link Here
78
        push @messages, { type => 'alert', code => 'does_not_exist' };
79
        push @messages, { type => 'alert', code => 'does_not_exist' };
79
    }
80
    }
80
} elsif ( $op eq 'add' ) {
81
} elsif ( $op eq 'add' ) {
82
    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
81
    my $allow_changes_from = $query->param('allow_changes_from');
83
    my $allow_changes_from = $query->param('allow_changes_from');
82
    eval {
84
    eval {
83
        $shelf = Koha::Virtualshelf->new(
85
        $shelf = Koha::Virtualshelf->new(
Lines 103-108 if ( $op eq 'add_form' ) { Link Here
103
        $op = 'view';
105
        $op = 'view';
104
    }
106
    }
105
} elsif ( $op eq 'edit' ) {
107
} elsif ( $op eq 'edit' ) {
108
    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
106
    $shelfnumber = $query->param('shelfnumber');
109
    $shelfnumber = $query->param('shelfnumber');
107
    $shelf       = Koha::Virtualshelves->find($shelfnumber);
110
    $shelf       = Koha::Virtualshelves->find($shelfnumber);
108
111
Lines 133-138 if ( $op eq 'add_form' ) { Link Here
133
        push @messages, { type => 'alert', code => 'does_not_exist' };
136
        push @messages, { type => 'alert', code => 'does_not_exist' };
134
    }
137
    }
135
} elsif ( $op eq 'delete' ) {
138
} elsif ( $op eq 'delete' ) {
139
    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
136
    $shelfnumber = $query->param('shelfnumber');
140
    $shelfnumber = $query->param('shelfnumber');
137
    $shelf       = Koha::Virtualshelves->find($shelfnumber);
141
    $shelf       = Koha::Virtualshelves->find($shelfnumber);
138
    if ($shelf) {
142
    if ($shelf) {
Lines 151-156 if ( $op eq 'add_form' ) { Link Here
151
    }
155
    }
152
    $op = 'list';
156
    $op = 'list';
153
} elsif ( $op eq 'add_biblio' ) {
157
} elsif ( $op eq 'add_biblio' ) {
158
    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
154
    $shelfnumber = $query->param('shelfnumber');
159
    $shelfnumber = $query->param('shelfnumber');
155
    $shelf = Koha::Virtualshelves->find($shelfnumber);
160
    $shelf = Koha::Virtualshelves->find($shelfnumber);
156
    if ($shelf) {
161
    if ($shelf) {
Lines 207-212 if ( $op eq 'add_form' ) { Link Here
207
    }
212
    }
208
    $op = $referer;
213
    $op = $referer;
209
} elsif ( $op eq 'remove_biblios' ) {
214
} elsif ( $op eq 'remove_biblios' ) {
215
    output_and_exit_if_error($query, $cookie, $template, { check => 'csrf_token' });
210
    $shelfnumber = $query->param('shelfnumber');
216
    $shelfnumber = $query->param('shelfnumber');
211
    $shelf = Koha::Virtualshelves->find($shelfnumber);
217
    $shelf = Koha::Virtualshelves->find($shelfnumber);
212
    my @biblionumbers = $query->multi_param('biblionumber');
218
    my @biblionumbers = $query->multi_param('biblionumber');
213
- 

Return to bug 22990